You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

📢 Newsroom Update

The new iPad mini is available today. Learn more >

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Stolen iPad Pro, lost mode is "pending"

The question is: Whilst lost mode is still "pending" is there a way that the thief can avoid going online and successfully wipe and claim the iPad whilst lost mode is still pending?

Posted on Sep 10, 2023 6:47 PM

Reply
Question marked as Top-ranking reply

Posted on Sep 11, 2023 4:56 AM

An iPad that has been instructed to erase using Apple’s Find My service will only erase when it receives the command to do so - this, logically, being determined by the iPad having an active network connection. If the Find My service indicates that the erase is pending, then the erase command has not [yet] been successfully delivered to the iPad; the status will change when [if] the command is successfully delivered to the device.


Nobody can gain access to your iPad without successfully entering the correct device Passcode - and for this, there are a limited number of tries before the iPad will automatically become disabled. As such a brute-force attempt to access the iPad, by guessing the correct passcode, is highly unlikely to be successful. Only if your device Passcode is known to whoever finds your iPad will any locally stored data be at risk of discovery.


iOS/iPadOS is architecturally designed to protect the owners data. 


All locally stored data is encrypted; by design, the only copy of the encryption keys necessary to access local data are held within the Secure Enclave - the device security chip. The device Passcode unlocks the Secure Enclave, which in turn releases the encryption keys to the Operating System while the device remains unlocked.


If an incorrect Passcode is repeatedly entered, the Secure Enclave automatically wiped and the device disabled - an operation that erases all stored encryption keys. This is known as a crypto-erase. Once erased, all locally stored data is permanently beyond reach and cannot be recovered.


Any attempt to reset the iPad will trigger the Activation Lock - this being a condition that cannot be bypassed. Only the bona-fide owner has the necessary information to reset the Activation Lock.


2 replies
Question marked as Top-ranking reply

Sep 11, 2023 4:56 AM in response to DAJKP

An iPad that has been instructed to erase using Apple’s Find My service will only erase when it receives the command to do so - this, logically, being determined by the iPad having an active network connection. If the Find My service indicates that the erase is pending, then the erase command has not [yet] been successfully delivered to the iPad; the status will change when [if] the command is successfully delivered to the device.


Nobody can gain access to your iPad without successfully entering the correct device Passcode - and for this, there are a limited number of tries before the iPad will automatically become disabled. As such a brute-force attempt to access the iPad, by guessing the correct passcode, is highly unlikely to be successful. Only if your device Passcode is known to whoever finds your iPad will any locally stored data be at risk of discovery.


iOS/iPadOS is architecturally designed to protect the owners data. 


All locally stored data is encrypted; by design, the only copy of the encryption keys necessary to access local data are held within the Secure Enclave - the device security chip. The device Passcode unlocks the Secure Enclave, which in turn releases the encryption keys to the Operating System while the device remains unlocked.


If an incorrect Passcode is repeatedly entered, the Secure Enclave automatically wiped and the device disabled - an operation that erases all stored encryption keys. This is known as a crypto-erase. Once erased, all locally stored data is permanently beyond reach and cannot be recovered.


Any attempt to reset the iPad will trigger the Activation Lock - this being a condition that cannot be bypassed. Only the bona-fide owner has the necessary information to reset the Activation Lock.


Sep 10, 2023 6:52 PM in response to DAJKP

If the thief tries to wipe the iPad it’s going to erase everything that you have on the iPad (if they could even be able to do it) but will need to go online to be able to even “Activate” which will then get stuck in Activation Lock which will not allow them to do anything more with the iPad without using the AppleID that it was signed into when they wiped it. Your iPad will be useless to them. If you put it in lost mode, once it gets Internet it will lock down and show the lost screen the next time that it comes up. It’s going to have to connect to a WiFi that it already knows as there will be no way that they can connect it to WiFi without getting past the Lock Screen.


If you didn’t have your iPad locked with a code then it still will not allow them to wipe it without having your AppleID password so it will still be safe. At least in this situation you’ll know that your information is kept safe.

Stolen iPad Pro, lost mode is "pending"

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.